Re: When did Debian decide to enable PIE by default?

From	<tomas@tuxteam.de>
Newsgroups	linux.debian.user
Subject	Re: When did Debian decide to enable PIE by default?
Date	2017-08-10 10:10 +0200
Message-ID	<ucQHv-2LF-11@gated-at.bofh.it> (permalink)
References	<ucAjo-bt-11@gated-at.bofh.it> <ucAt5-fu-37@gated-at.bofh.it> <ucJwl-6s8-5@gated-at.bofh.it> <ucJwl-6s8-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Aug 09, 2017 at 08:22:58PM -0400, Gene Heskett wrote:
> On Wednesday 09 August 2017 10:52:26 慕 冬亮 wrote:
> 
> > On 08/09/2017 10:48 AM, Gene Heskett wrote:
> > > On Wednesday 09 August 2017 10:31:48 Thomas Schmitt wrote:
> > >> Hi,
> > >>
> > >> 慕 冬亮 <mudongliangabcd@hotmail.com> wrote:
> > >>> When does Debian Team, or Security Team decide to enable PIE by
> > >>> default?
> > >>
> > >> I guess it was one year ago. At least that's the dates one can see
> > >> on https://wiki.debian.org/Hardening/PIEByDefaultTransition
> > >
> > > Interesting Thomas, but what the heck is PIE?  I know about PAE, but
> > > PIE? Whats it do?  Searching the above wiki returned only this
> > > thread.
> >
> > Please take a look at the following URL:
> >
> > https://wiki.debian.org/Hardening#DEB_BUILD_HARDENING_PIE_.28gcc.2Fg.2
> >B-.2B-_-fPIE_-pie.29
> >
> Aha, another name for PIC, which I've only been writing code that uses it 
> for 32 years. Also known as PCR, for Program Counter Relative.  Such 
> code can be loaded into memory and executed without any patching.

Not exactly. PIC is "position independent code". Shared libraries have
been compiled like that for a long time since (especially under 32 bits)
you never knew where was a hole in memory to mmap the library in.

PIE is "position independent executable": it's about using PIC in the
Executable -- since that's the first to map in, the whole (well, nearly)
address space is available, and there's no need to generate PIC. Since
(under Intel) PIC is a tad slower than non-PIC, well...

But thanks PIE you can map the executable itself into a random address
(ASLR), which makes it more difficult for an attacker to find useful
"tools" in the executable image.

> > It is a security feature which combines with ASLR to do full address
> > space randomization.

Yes.

Cheers
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlmMEqkACgkQBcgs9XrR2kasngCeI49Xp+FPFo34Uy7FXvro2Vzq
+VMAn1QCl0A+qu/5PK9hua7Hp8q8ZJP7
=KyAN
-----END PGP SIGNATURE-----

Thread

Re: When did Debian decide to enable PIE by default? "Thomas Schmitt" <scdbackup@gmx.net> - 2017-08-09 16:40 +0200
  Re: When did Debian decide to enable PIE by default? Gene Heskett <gheskett@shentel.net> - 2017-08-09 16:50 +0200
    Re: When did Debian decide to enable PIE by default? Dan Ritter <dsr@randomstring.org> - 2017-08-09 17:10 +0200
      Re: When did Debian decide to enable PIE by default? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-08-09 20:00 +0200
    Re: When did Debian decide to enable PIE by default? Tony van der Hoff <lists@vanderhoff.org> - 2017-08-09 17:30 +0200
    Re: When did Debian decide to enable PIE by default? Gene Heskett <gheskett@shentel.net> - 2017-08-10 02:30 +0200
      Re: When did Debian decide to enable PIE by default? <tomas@tuxteam.de> - 2017-08-10 10:10 +0200
        Re: When did Debian decide to enable PIE by default? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-08-12 13:20 +0200
          Re: When did Debian decide to enable PIE by default? <tomas@tuxteam.de> - 2017-08-12 16:10 +0200
  Re: When did Debian decide to enable PIE by default? <tomas@tuxteam.de> - 2017-08-10 10:00 +0200

csiph-web